XML External Entity Vulnerability in Lantronix Provisioning Manager
CVE-2025-7766
8.6HIGH
What is CVE-2025-7766?
The Lantronix Provisioning Manager is susceptible to XML external entity (XXE) attacks due to inadequate handling of configuration files from network devices. This vulnerability can potentially allow an attacker to execute unauthorized commands on systems running the Provisioning Manager, resulting in severe security risks. Organizations utilizing this product should implement immediate security measures to mitigate the threat and ensure network safety.
Affected Version(s)
Provisioning Manager 0 <= 7.10.2
References
CVSS V4
Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Robert McLellan reported this vulnerability to CISA.